Fortinet FCSS_SDW_AR-7.4 Online Practice Questions and Exam Preparation

Fortinet FCSS_SDW_AR-7.4 Online Questions & Answers

• Question 1:

  Which routing protocol is preferred for overlay networks with dynamic ADVPN tunnels?

  A. OSPF
  B. RIP
  C. IBGP
  D. Static routes
  C. IBGP

  ---

  explanation:

  Explanation

  IBGP preserves next-hop information across dynamically formed tunnels and scales efficiently for ADVPN overlays, making it the standard routing protocol for Fortinet SD-WAN ADVPN environments.

• Question 2:

  What happens when ADVPN spokes are configured with auto-discovery-receiver disabled?

  A. The spokes can still form shortcuts initiated by hubs.
  B. The spokes cannot receive shortcut offers, blocking dynamic tunnel creation.
  C. The spokes initiate shortcuts to other spokes automatically.
  D. The spokes will rely solely on static IPsec tunnels.
  B. The spokes cannot receive shortcut offers, blocking dynamic tunnel creation.

  ---

  explanation:

  Explanation

  Disabling auto-discovery-receiver prevents spokes from accepting ADVPN shortcut proposals, effectively disabling dynamic shortcut formation.

• Question 3:

  What is the effect when traffic matches the implicit SD-WAN rule?

  A. The traffic is dropped.
  B. The traffic uses equal-cost multipath load balancing.
  C. The session shows no SD-WAN service ID.
  D. FortiGate automatically creates a new rule.
  C. The session shows no SD-WAN service ID.

  ---

  explanation:

  Explanation

  The implicit SD-WAN rule handles unmatched traffic and does not assign a service ID. It ensures forwarding continuity even when no explicit rules match.

• Question 4:

  Which command helps identify which SD-WAN service rule a session matched?

  A. diagnose sys sdwan service
  B. diagnose sys session list
  C. diagnose sys sdwan health-check
  D. get router info routing-table all
  B. diagnose sys session list

  ---

  explanation:

  Explanation

  The diagnose sys session list output includes the SD-WAN service ID that matched the session, essential for verifying steering logic and rule mapping.

• Question 5:

  What routing design is recommended for multi-region SD-WAN topologies without inter-region ADVPN requirements?

  A. OSPF intra-region and EBGP inter-region
  B. IBGP on loopbacks intra-region and EBGP inter-region
  C. OSPF with redistribution at region boundaries
  D. Single OSPF area across all regions
  B. IBGP on loopbacks intra-region and EBGP inter-region

  ---

  explanation:

  Explanation

  Using IBGP within regions provides scalable routing, while EBGP between regions isolates route domains and enables independent control per region.

• Question 6:

  Which two performance probes are supported in Prefer Passive mode? (Choose two.)

  A. UDP
  B. ICMP
  C. TCP
  D. HTTP
  B. ICMP
  C. TCP

  ---

  explanation:

  Explanation

  Prefer Passive mode uses existing TCP or ICMP traffic to evaluate latency and loss, reducing probe overhead and preventing unnecessary synthetic traffic generation.

• Question 7:

  What is the behavior of FortiGate when all members of a performance SLA fail?

  A. Traffic continues on the lowest latency path.
  B. Traffic is dropped and logged as "SLA failed."
  C. The SD-WAN rule is bypassed, and routing table lookup is used.
  D. FortiGate switches to implicit SD-WAN rule operation.
  C. The SD-WAN rule is bypassed, and routing table lookup is used.

  ---

  explanation:

  Explanation

  When all SLA members fail, SD-WAN rule steering stops, and FortiGate falls back to system routing decisions, ensuring traffic continuity through default routes.

• Question 8:

  Which FortiManager template is responsible for creating IPsec tunnels used in SD-WAN overlay deployments?

  A. CLI Template
  B. SD-WAN Template
  C. IPsec Tunnel Template
  D. Routing Template
  C. IPsec Tunnel Template

  ---

  explanation:

  Explanation

  The IPsec tunnel template defines tunnel parameters (peer, key, interface) that are later referenced in overlay and BGP templates to automate SD-WAN topology creation.

• Question 9:

  When enabling ADVPN between two hub-and-spoke domains, which configuration on the hubs is mandatory?

  A. auto-discovery-receiver on spokes only
  B. auto-discovery-forwarder and auto-discovery-sender on the hubs
  C. auto-discovery-receiver on the hubs and spokes
  D. auto-discovery-forwarder only on the hubs
  B. auto-discovery-forwarder and auto-discovery-sender on the hubs

  ---

  explanation:

  Explanation

  Hubs must be able to forward and advertise ADVPN shortcut offers to spokes, which is achieved with the auto-discovery-forwarder and auto-discovery-sender settings on hub VPNs.

• Question 10:

  In a Fortinet SD-WAN dual-hub design, what is the role of the minimum-sla-meet-members setting?

  A. It defines the minimum number of tunnels required for active-active operation.
  B. It specifies the number of SD-WAN members that must meet the SLA before traffic is forwarded.
  C. It defines the number of backup tunnels required for redundancy.
  D. It determines the number of hubs that can participate in ADVPN shortcuts.
  B. It specifies the number of SD-WAN members that must meet the SLA before traffic is forwarded.

  ---

  explanation:

  Explanation

  This parameter enforces SLA compliance by requiring a specified number of links to meet SLA thresholds before forwarding. It ensures stability and avoids routing traffic over degraded links.